Enhancement request: Support global, per product, and per package registry/proxy configuration for purl2url
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 35/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 停滞
- 技术栈
- python
调研方向
Start by locating the existing purl2url conversion entry point and the SBOM-import automatic-scan flow, then identify how global, product, and package settings are stored and resolved. Done means supported package managers honor global < product < package registry overrides, including automatic SBOM scans, with tests covering precedence.
由索引模型根据 Issue 内容生成。
描述
Is your enhancement request related to a problem? Please describe.
Currently, DejaCode attempts to convert the PURL to a URL in order to submit a scan to ScanCode.io. Since PURLs do not contain any indication where the package is actually stored, this will not work for when the packages are stored in an internal artifact registry service (like Nexus, JFrog Artifactory, or similar). Additionally, attempting to download packages directly from the package registries could trigger rate limits or some organization may block direct downloads for security reasons, so that the use of an artifact proxy registry may be required (essentially, instead of requesting a package from e.g., npm, one would direct the request at the proxy registry on the internal artifact server, which would then request it from npm and the package data would be cached for subsequent requests by the artifact registry service)
What are the benefits of the requested enhancement?
If the target registry could be configured, then downloads from an internal artifact registry would be possible. This would help with analyzing internal packages that are not published to the public registry of the respective package manager and also support usage in security restricted environments.
Describe the solution you would like
This suggested approach would be a tiered configuration, global, per product, and per package, where for each supported package manager one can set the target registry, which would override the default purl2url behavior. Furthermore the configuration for the global configuration would be overridden by the product configuration and the product configuration overridden by the package configuration.
Additional notes
This feature should be compatible with SBOM imports followed by automatic scans (applying the global or product settings, or if package already exists, the package specific one)
- 主要语言
- Python
- 星标
- 52
- 派生
- 30
- 平均合并
- 10 小时 18 分钟
- 30 天内合并 PR
- 15
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
aboutcode-org/dejacode 的其他 Issue
-
Unify product Clone, "Save as new" and admin "Save as new" into a single clone feature可能已有人在做 @Anurag-S1ngh 于 2 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 45/100
aboutcode-org/dejacode#603 ·
维护者通常 1 天内回复
-
design needed enhancement
难度 3/5 1-2 天 新手友好度 62/100
aboutcode-org/dejacode#561 · 3 条评论 ·
维护者通常 1 天内回复
-
Enhancement request: Refine License Category - Copyleft Limited可能重新可做 @hesa 于 122 天前认领，目前没有进行中的 PR。 未关闭design needed enhancement
aboutcode-org/dejacode#499 · 13 条评论 · 已指派 3 人 ·
维护者通常 1 天内回复
-
BUG: Product overview page splits product with many versions across pages可能重新可做 关联的 PR 已关闭且未合并。 未关闭bug design needed enhancement
难度 3/5 1-2 天 新手友好度 45/100
aboutcode-org/dejacode#460 ·
维护者通常 1 天内回复
-
design needed
难度 5/5 一周以上 新手友好度 20/100
aboutcode-org/dejacode#452 · 2 条评论 ·
维护者通常 1 天内回复
查看 aboutcode-org/dejacode 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 82/100
Nixtla/mlforecast#823 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 65/100
microsoft/ML-For-Beginners#1061 ·
-
bot-found documentation priority: P3
难度 2/5 1 小时以内 新手友好度 82/100
madenvel/KalinkaPlayer#503 ·
-
难度 2/5 1-3 小时 新手友好度 63/100
EleutherAI/lm-evaluation-harness#4508 ·
维护者通常 1 天内回复